Executive brief
Welcart is a popular e-commerce plugin for WordPress that handles online payments and checkout. The plugin contains a critical flaw that allows unauthenticated attackers to inject malicious data during checkout and later trigger file deletion on the server, including critical WordPress configuration files. This can lead to complete server compromise and data loss if an administrator attempts to print an invoice.
Technical details
The vulnerability is a PHP Object Injection (deserialization attack) in the Telecom EDY payment callback handler (usces_action_acting_transaction). Attackers can store arbitrary serialized PHP objects as order metadata during public checkout without authentication. The callback accepts an 'option' parameter that directly unserializes this metadata without validating provider signatures, source addresses, or transaction ownership. A known PHP Object Gadget (POP) chain exists in the bundled TCPDF library that enables arbitrary file deletion through the unserialize() operation. Successful exploitation requires an administrator to print an invoice (triggering the TCPDF code path), at which point the POP chain executes and deletes files, including wp-config.php, leading to remote code execution when combined with re-installation of WordPress against an attacker-controlled database.
Affected products
- WordPress Welcart e-Commerce up to and including 2.12.1
Timeline
- 2026-09-05: disclosed